Blocking attachments, maybe subject line statement?

[Julian Field]

At 17:02 23/01/2004, you wrote:
>Apprently there is some new worm out that generates emails that appear to
>come from our billing department. I cant find anything on it anywhere, but
>the file that it has with it is a page.hta file. I want to block this
>email altogether, so what is the best way to go about doing that? I was
>going to black list them, but since it is apparently some kind of worm,
>its from all different sorts of people. What sort of action should I take
>with this?
>
>Chris

If they have merely used your billing department's email address as the
"From" address in email they are sending, there is nothing you can do to
stop this propagating across the internet, as it never goes anywhere near
your servers.

Using MailScanner's filename.rules.conf file you can block .hta files
coming into your site or leaving your site. It blocks them by default.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654